Allow cors from any domain

my_api.rb

class MyAPI < Grape::API
  class CrossOriginResourceSharingPolicy < Grape::Middleware::Base
    def append_cors_headers(headers)
      headers['Access-Control-Allow-Origin'] = env['HTTP_ORIGIN'] || '*'
      headers['Access-Control-Allow-Credentials'] = 'true'
      headers['Access-Control-Max-Age'] = '180'
      if env['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']
        headers['Access-Control-Allow-Headers'] = env['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']
      end
      headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, OPTIONS'
    end

    def call!(env)
      @env = env

      append_cors_headers_for_error(catch(:error){
        @app_response = @app.call(@env)
        append_cors_headers @app_response[1]
        return @app_response
      })
    end

    def append_cors_headers_for_error(error = {})
      error[:headers] ||= {}
      append_cors_headers(error[:headers] ||= {})
      # throw again to let Error middleware to handle it
      throw :error, error
    end
  end
  use CrossOriginResourceSharingPolicy
end

See

• W3C Standard
• StackOverflow post: http://stackoverflow.com/questions/5251689/cross-domain-post-query-using-cross-origin-resource-sharing-getting-no-data-back

Pay attention that Rack converts request headers to upcase with prefix HTTP_ and replaces all dashes to underscores.